CVE-2024-2880

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.5 through 16.11.6 GitLab CE/EE versions 17.0 through 17.0.4 GitLab CE/EE versions 17.1 through 17.1.2

Description The issue is related to insufficient access control in the admin group member function of the Group Member Handler component in GitLab. This can allow a remote attacker to ban arbitrary group members. A user with the admin group member custom role permission can exploit this issue.

Recommendations For GitLab CE/EE versions 16.5 through 16.11.6, update to version 16.11.6 or later. For GitLab CE/EE versions 17.0 through 17.0.4, update to version 17.0.4 or later. For GitLab CE/EE versions 17.1 through 17.1.2, update to version 17.1.2 or later. As a temporary workaround, consider restricting the admin group member custom role permission to minimize the risk of exploitation.